All Apps and Add-ons

Distributed vs Streaming command

valiquet
Contributor

Is there a way to know the load an SPL query puts on the index vs the search head cluster when running? By looking at the doc, it's not always clear, so perhaps is there some REST call or job inspector values I can check?

If not, some CLI could give us some clues inside var/run/lib.

Thanks

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

If you let the job finish and look at the job inspector, you can see how long each part of the search required, how many events went into each step and how many came out. That combined with the list of known distributed vs streaming commands will provide some insight here.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you let the job finish and look at the job inspector, you can see how long each part of the search required, how many events went into each step and how many came out. That combined with the list of known distributed vs streaming commands will provide some insight here.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...